1. Overview & Privacy Philosophy

At ChessRank.org ("ChessRank", "we", "us"), privacy is built into our architecture. Unlike commercial platforms that profit from selling targeted ads or selling user profiles to third-party data brokers, ChessRank.org operates without advertising tracking.

This Privacy Policy details the minimal data we collect, how it is used, where it is stored, and your rights under privacy legislation including the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Who is responsible for your data. ChessRank.org is built and operated by Matěj Štaif (see Behind ChessRank.org), an individual based in the Czech Republic, who is the data controller for the processing described here. You can reach the controller at any time at [email protected]. We are not required to appoint a Data Protection Officer, so this address reaches the controller directly.

2. Data We Do NOT Collect

To be completely transparent about what we do not do:

No Commercial Ad Tech: We do not run Google AdSense, Quantcast CMP, or programmatic advertising exchanges. We do not place ad cookies or share your profile with ad tech partners.
No Data Monetization: We never sell, rent, trade, or share your personal data or chess history with third parties for marketing purposes.
No Cross-Site Tracking: We do not track your activity on external websites.

3. Information We Collect & How It Is Used

A. Privacy-Focused Analytics (Cookieless)

We collect basic aggregate usage telemetry using Umami Analytics (collect.chessrank.org/cr.js), Vercel Web Analytics and Vercel Speed Insights to keep the platform reliable and fast:

Cookieless Operation: No persistent tracking cookies or advertising identifiers are stored in your browser for analytics.
No visitor profile: Your IP address is used only transiently, to derive a non-reversible daily hash that distinguishes one visit from another, and is not stored alongside the resulting statistics. We measure total page visits, popular tools (e.g. Free Game Review, Blunder Trainer), approximate country, device type and site performance, never an individual browsing history.
Production only: Analytics run exclusively on the live site. Development and preview builds send nothing at all.

B. Account Information (Registered Users)

You can use ChessRank.org as a guest without registering. If you choose to create an account:

Sign-in data: Your email address and either a password or the account you sign in with. Passwords are stored by Supabase Auth only as a salted cryptographic hash, never in readable form. If you sign in with Google or Apple, we receive from that provider a unique account identifier, your email address (with Apple, possibly a private relay address) and the basic profile information the provider shares, such as your name and profile picture, which Supabase Auth stores with your account.
Profile data: Your username, optional display name, optional avatar image that you upload, the Chess.com and Lichess usernames you link to your account, your preferred language, and the app settings you choose to sync to your account.
Chess and training data: Puzzle ratings, attempts, solved puzzles, streaks, Puzzle Rush results, league and leaderboard points, saved custom puzzles, deck progress, excerpts of games in which you played a Brilliant move, and a snapshot of your public Chess.com and Lichess ratings, which we fetch from those platforms and show on your profile.
Cloud copies of your analyses: While you are signed in, your saved game Reports, Blunder puzzle runs and deck progress are automatically mirrored to our database and kept for 14 days, together with short Recent Games summaries (accuracy and move counts) kept for 180 days. This keeps your work safe when your browser storage is cleared and lets you open it on another device. These copies contain the analysed games, including the usernames and ratings of your opponents as published by Chess.com or Lichess.
Saved PGN games: When a game you paste in PGN format is saved to your games, which some PGN tools do automatically, we store the PGN text, the side you played, the event name and the date of the game in your account, so that you can open it again on any device. A PGN usually contains the names of both players and may contain their ratings, the event and other details recorded in the game. As a guest, saved PGN games stay only in your browser.
Saved games against bots: When you finish a game against a bot (Play Bots) or against a player's Ghost Bot (Opponent Prep), including an openings-only drill, we store in your account the PGN text, the side you played, the name of the bot or of the player whose Ghost Bot you played, that player's rating as published by Chess.com or Lichess, and when the game ended, so that you can open it again on any device. As a guest, these games stay only in your browser.
Your notes: If you turn on Your notes or Extended Self-review, we store what you add to a game (notes, move marks, who you think is better, your score and the variations you try on the board) in your account, so that you can see it on any device. As a guest, they stay only in your browser.
Activity data: The date you created your account, the days on which you were active and the time of your last activity, which we use for streaks, statistics, leagues and account emails.
Friends: The friend connections you create with other users.

C. Public Profile, Leaderboards & Social Features

Some features of ChessRank.org are public by design. Please choose your username, display name and avatar with that in mind:

Public profile: Your profile page is always public and anyone can view it. It shows your username, display name, avatar, account creation date, puzzle and training statistics, and the Chess.com and Lichess usernames you link to your account, together with their ratings. Public profiles are part of the service, so a profile cannot be hidden. It contains no sensitive personal data unless you add it yourself, for example by choosing a username, display name or avatar that reveals your real identity. Profile pages carry a noindex tag, so search engines do not show them in their results. To remove your profile, delete your account.
Leaderboards: When you solve puzzles, play Puzzle Rush or collect Brilliant moves while signed in, your username, avatar and the relevant scores appear on the public leaderboards, and short excerpts of the games in which you played a Brilliant move (a few moves around it, which may include the players' names as recorded in the game) can be viewed by anyone. Leaderboards are an integral part of the service. If you do not want to appear on them, you can use the Platform as a guest or delete your account, which removes you from every leaderboard.
Friends: Users can add each other as friends and see each other's profile statistics.

D. Product and Service Emails

We may use a registered user’s email address to send occasional, relevant emails about ChessRank.org features and closely related product updates where applicable law permits. For this purpose, we process the email address, product email preference, and limited delivery, unsubscribe, and suppression metadata. Our legal basis is our legitimate interest in keeping registered users informed about our own similar services, subject to the customer opt-out rules that apply to electronic marketing.

You can object to product emails at any time in Settings, through the unsubscribe link in each product email, or by contacting [email protected]. After you opt out, we stop sending product emails. This preference does not prevent service messages needed to operate or secure your account, such as email verification, password resets, security notices, or notices about material changes to the Platform or its terms.

E. Public Chess Data Import

When you use tools like Free Game Review, Opponent Prep, your dashboard or your profile, you may enter or link a public Chess.com or Lichess username, or paste a PGN. The Platform then fetches the requested public game archives, ratings and profile data directly from your browser using the official public APIs of Chess.com (api.chess.com) and Lichess (lichess.org). Chess.com and Lichess therefore receive your IP address and the usual technical request data (such as your browser's user agent) and process them as independent controllers under their own privacy policies. We never send them your email address or any other account data.

These archives are public data published by Chess.com and Lichess and may include other players' usernames, ratings and games, for example those of your opponents or of the player you research with Opponent Prep. We process such data in your browser only to produce the analysis you asked for, based on the legitimate interest in chess training and analysis, and store it on our servers only as part of the cloud copies and leaderboard excerpts described above.

F. Local Storage on Your Device

To deliver an instant UI without server roundtrips, your theme (dark/light), piece style, sound volume, board preferences, local engine cache, guest progress and, when you are signed in, your login session are saved locally in your browser's localStorage and IndexedDB. You can clear this data at any time via your browser settings or Settings.

G. Feedback and Bug Reports

If you send us feedback or a bug report through one of the forms on the Platform (for example on Behind ChessRank.org, in Settings or below a blog post), we receive your message, the category you picked and, only if you choose to provide them, your email address and an attached image. An attached image is uploaded to our Supabase storage under a random file name, and a link to it is included in your message. The message itself is delivered to us by email through Web3Forms.

H. Chess Coach Voice

When Chess Coach speaks, the sentence shown in the bubble is sent by our server to an external text-to-speech service. Coach sentences never contain your name, email address or any other account data. The request is made by our server, not by your browser, so the service receives only the text of the sentence and never your IP address or any other personal data.

I. Technical Logs & Security

Like every website, our hosting and network providers (Vercel and Cloudflare) process technical data about each request, such as your IP address, the requested URL, the time, your browser's user agent and an approximate location derived from the IP address. This data is used to deliver the page, protect the Platform against abuse and attacks, and diagnose errors. It is kept only for a short time and is never used to build a profile of you.

4. In-Browser Stockfish Engine Computation

When you run game analysis or solve tactical blunders, the Stockfish engine executes directly inside your web browser via WebAssembly (WASM).

Local Computation: Your computer or smartphone handles the engine evaluation locally, and the engine calculations themselves are never sent to us. When you are signed in, the results of your analyses (Reports, Blunder puzzle runs, deck progress, Recent Games summaries and Brilliant move excerpts) are stored in your account as described in section 3.

5. Third-Party Processors and Recipients

We use the following providers strictly to host and operate the Platform. Each acts as a processor on our behalf, processes data only to maintain uptime, security and performance, and is bound by its own data processing agreement:

Vercel Inc.: Global edge hosting, static content delivery and serverless runtime. Vercel processes connection metadata (including IP address) as part of serving every request, and provides the aggregate Vercel Analytics and Speed Insights measurements described in section 3.
Supabase: Encrypted cloud database, authentication (including sign-in with Google and Apple) and file storage for avatars and feedback images, for registered accounts and the features described in section 3.
Cloudflare: Runs in front of the entire Platform as our DNS, content delivery network, security and caching provider and edge computing platform (Cloudflare Workers, including cached leaderboards). Cloudflare also carries the analytics events to our own Umami server through an encrypted tunnel (collect.chessrank.org). It therefore handles every connection to the Platform, including your IP address, in transit.
Umami Analytics (self-hosted) and Hetzner: Cookieless analytics that we run ourselves on our own server at Hetzner Online GmbH in Germany (EU). The measurement script and the analytics events go only to our own collect.chessrank.org subdomain. The data stays on that server and is not sent to Umami Software.
Amazon Web Services (Amazon SES): Delivers account service messages and, where permitted, product emails. Amazon processes recipient addresses and limited delivery, bounce, complaint, unsubscribe, and suppression metadata on our behalf. To tell whether an email arrived and was useful, Amazon SES also records whether it was opened, using a small invisible image, and which link was clicked, by passing links through an Amazon redirect address.
Web3Forms: Delivers the optional feedback and bug report forms described in section 3. If you submit a form, your message, the link to any attached image and any contact details you choose to include are transmitted through Web3Forms to reach us by email.
Google Cloud and Oracle Cloud Infrastructure: Google Cloud hosts the configuration used for “Sign in with Google”. Oracle Cloud Infrastructure provides computing resources we use to operate and develop the Platform. To the extent that they process personal data, they do so only on our behalf and on our instructions.
Stripe: If you choose to make a voluntary donation, you leave the Platform and complete the payment on Stripe’s own hosted checkout. Stripe acts as an independent controller for that transaction under its own privacy policy. We never receive or store your card details.

Independent controllers. Google and Apple act as independent controllers when you choose to sign in with them, process your sign-in under their own privacy policies, and share with us only the information described in section 3. Chess.com and Lichess act as independent controllers for the requests your browser sends to them. Stripe acts as an independent controller for donations. We never sell, rent or trade your personal data.

6. International Data Transfers

Some of the providers listed above, including Vercel, Supabase, Cloudflare, Amazon Web Services, Web3Forms, Google, Apple, Oracle and Stripe, operate infrastructure outside the European Economic Area, including in the United States. Where personal data is transferred outside the EEA, that transfer is covered by the safeguards those providers offer, in practice the European Commission’s Standard Contractual Clauses and, where applicable, the EU-US Data Privacy Framework or an adequacy decision of the European Commission.

7. Legal Bases for Processing

Under Article 6 of the GDPR, every processing operation needs a legal basis. Ours are:

Contract (Art. 6(1)(b)): Creating and running your account (including sign-in with Google or Apple), storing your training progress and the cloud copies of your analyses, showing your public profile, your leaderboard entries and the friends features that form part of the service, and delivering the analysis and Chess Coach voice you request. Without this data the service you asked for cannot be provided.
Legitimate interests (Art. 6(1)(f)): Aggregate, cookieless audience measurement, keeping the Platform secure and available through short-lived technical logs, preventing abuse, processing publicly available chess data of other players to deliver the analysis you request, and, where permitted by applicable electronic marketing rules, sending registered users occasional product emails about our own similar services. You can object to this processing at any time, including to product emails.
Consent (Art. 6(1)(a)): Sending us optional feedback and attachments. You can withdraw consent at any time, which does not affect processing carried out beforehand.
Legal obligation (Art. 6(1)(c)): Retaining records where the law requires it, for example in connection with donations and the minimum suppression record needed to honour a product email opt-out.

Strictly necessary storage (your theme, language, sound and board preferences, and your login session) is exempt from the consent requirement in Article 5(3) of the ePrivacy Directive because it delivers a service you explicitly requested. We store no advertising or cross-site tracking identifiers of any kind, which is why ChessRank.org shows no cookie consent pop-up.

8. Data Security & Retention

All network communication with ChessRank.org is encrypted in transit using Transport Layer Security (TLS/HTTPS). Account data is encrypted at rest, and passwords are protected using industry-standard cryptographic hashing algorithms.

We keep data no longer than it is useful for the purpose it was collected for:

Account and training data: Kept while your account is active. When you delete your account in Settings, we delete your profile, sign-in data, cloud copies, leaderboard entries, Brilliant move excerpts, friend connections and uploaded avatar, except for minimum records that we must retain to comply with law, such as a product email suppression record. Right after the deletion we send one final goodbye email to the address that was on the account, and we do not keep that address for any other purpose.
Cloud copies of analyses: Reports, Blunder puzzle runs and deck progress are deleted 14 days after they were saved, Recent Games summaries after 180 days.
Saved PGN games: We keep the 1,000 games you saved most recently, with no time limit. Once you have 1,000, each newly saved game replaces the oldest one. Otherwise a game is deleted only together with your account, and you can ask for earlier deletion at [email protected].
Saved games against bots: We keep the 50 games you finished most recently, with no time limit. Once you have 50, each new game replaces the oldest one. Otherwise a game is deleted only together with your account, and you can ask for earlier deletion at [email protected].
Your notes: We keep the notes and variations of the 1,000 games you changed most recently, with no time limit. Once you have 1,000, annotating another game replaces the notes and variations of the game you changed longest ago. Otherwise they are deleted only together with your account, and you can ask for earlier deletion at [email protected].
Analytics: Aggregate, non-identifying counts only. No visitor-level profile is built or retained.
Technical logs: Kept by Vercel and Cloudflare only for a short time, for delivery, security and troubleshooting.
Usage limits: To apply the usage limits described in our Terms of Service, we keep an irreversible hash of the network address a request comes from, together with how often a demanding feature such as Opponent Prep was used from it, for up to 30 days. It is never linked to your account or used for anything else.
Email delivery data: limited delivery metadata is kept only as long as needed to operate and protect the email service. If you opt out, we retain the minimum suppression record needed to honour your choice and prevent future product emails, including after account deletion. A history of the emails we send (recipient, subject, and whether each one was delivered, opened or clicked) is kept for 30 days and then deleted automatically.
Feedback messages and attached images: Kept only as long as needed to deal with what you wrote to us.
Guest data: never leaves your device, and is cleared whenever you clear your browser storage.

9. Your Rights under GDPR & CCPA

Regardless of where you live, we respect your fundamental data rights:

Right to Access: You can request a copy of all personal data associated with your account.
Right to Rectification: You can change your username and display name in your profile, although a waiting period of up to 30 days may apply between two changes. You can update your avatar, linked accounts and preferences at any time in your profile and in Settings.
Right to Erasure ("Right to be Forgotten"): You can delete your account and associated saved data at any time, directly in Settings. We may retain minimum records where the law requires it, such as the record needed to honour a product email opt-out.
Right to Data Portability: On request by email, we provide the personal data you have given us in a structured, commonly used and machine-readable format (such as JSON).
Control over public features: Your profile and leaderboard entries are public as part of the service and cannot be hidden. You decide what they show through your username, display name and avatar, and deleting your account removes your profile and all your leaderboard entries.
Right to Object and to Restrict Processing: You can object to processing we carry out on the basis of legitimate interests, and ask us to restrict processing while an objection or a correction is being resolved.
Right to Withdraw Consent: Where we rely on consent, you can withdraw it at any time.

Right to lodge a complaint. If you believe we have handled your data unlawfully, you can complain to a data protection supervisory authority, in the Czech Republic the Office for Personal Data Protection (Úřad pro ochranu osobních údajů, uoou.gov.cz), or the authority in your own country of residence.

For California residents. We do not sell your personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined by the CCPA/CPRA. Because we run no advertising, there is nothing to opt out of. Exercising any right above will never result in a worse or more limited service.

No automated decision-making. Your chess ratings, accuracy scores and move classifications are produced by a chess engine to help you train. They are not used to make any decision that produces a legal or similarly significant effect on you within the meaning of Article 22 of the GDPR.

To exercise any of these rights, email [email protected]. We answer without undue delay and in any case within one month.

10. Children's Privacy

ChessRank.org is designed for chess players of all ages. We do not knowingly collect personal identifiable information from children under the age of 13 (or 16 in applicable European jurisdictions) without parental consent. If you believe a child has provided us with personal information, please contact us so we can immediately delete it.

11. Updates to This Privacy Policy

We may update this Privacy Policy to reflect new features, changes in the providers we use, or new legal requirements. Every version shows the date from which it applies. If a change materially affects how we process your personal data, we will inform registered users in advance by email or by a clear notice on the Platform, and where the law requires your consent, we will ask for it. Earlier versions are available on request at [email protected].

12. Contact Us

If you have questions, feedback, or data privacy requests regarding this policy, please reach out to us via email at [email protected] or visit our Behind ChessRank.org page.

ChessRank.org is an independent project and is not affiliated with, endorsed or sponsored by Chess.com, Inc., Lichess or Stockfish. All trademarks are the property of their respective owners.